CVE-2019-11707

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR < 60.7.1, Firefox < 67.0.3, and Thunderbird < 60.7.2.

Affected

Mozilla · Firefox ESR · Firefox · Thunderbird

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

37.70% chance of exploitation in the next 30 days, 99th percentile

CISA KEV

added 2022-05-23

Published

2019-07-23

Updated

2025-10-21

Proof-of-concept exploits (6)

• flabbergastedbd/cve-2019-117072★ · 2020-04-14
• securesystemslab/pkru-safe-cve-html0★ · 2022-01-29
• tunnelshade/cve-2019-117072★ · 2020-04-14
• vigneshsrao/CVE-2019-1170742★ · 2019-08-18
• CosminGGeorgescu/CVE-2019-11707-PoC0★ · 2026-02-05
• G4sp4rCS/CVE-2019-11707-from-an-IonMonkey-type-confusion-to-SYSTEM-0★ · 2026-10-09

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/47038
• https://www.exploit-db.com/exploits/50691

Security advisories

• https://bugzilla.mozilla.org/show_bug.cgi?id=1544386
• https://www.mozilla.org/security/advisories/mfsa2019-18
• https://www.mozilla.org/security/advisories/mfsa2019-20
• https://security.gentoo.org/glsa/201908-12

References

• CVE Record
• NVD entry

Related

• CVE-2019-9810
• CVE-2015-8351
• CVE-2021-43857
• CVE-2022-25012
• CVE-2023-2255
• CVE-2023-32784